This Privacy Policy is applicable only to personal data obtained on the Website and shall not apply to information collected by third parties on other websites, even if these were linked by the Website.

We care about your privacy. ENTIDAD NACIONAL DE ACREDITACIÓN, as the entity responsible for this website, seeks to provide the strictest legal guarantees with regard to your privacy and to explain clearly and transparently everything that you are consenting to in relation to the processing of personal information on this website. Information updated on 10-04-2024.

ENTIDAD NACIONAL DE ACREDITACIÓN (ENAC) has adapted this website to the requirements of Organic Law 3/2018, of 5 December, on the Protection of Personal Data (“LOPD”) and Royal Decree 1720/2007, of 21 December, referred to as the Implementing Regulations of the LOPD. It also conforms to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons (“GDPR”) and to Law 34/2002, of 11 July, on Services of the Information Society and Electronic Commerce (“LSSICE” or “LSSI”).

1. Who is the controller of your data?

  • Identity: ENTIDAD NACIONAL DE ACREDITACIÓN, Tax ID Code G-78373214
  • Postal address: C/ Serrano 240, 4ª A-B 28016 Madrid
  • Telephone: 91 457 32 89
  • Data protection email: rgpd@enac.es

2. Why do we process your personal data? 

ENAC processes the information it receives from data subjects for the following purposes:

  • Contact. To get in touch with you, whether by telephone or by e-mail, or to answer questions or requests for information, quotes, etc. that you address to us via our Website or by e-mailing us at the address established for this purpose. The legal basis of the processing of the data is based on user consent.
  • User registration. Users can register on our Websiteby providing their identification data, such as e-mail, password, name, surnames and ID card number. The data will be processed to register the users on the Website and to allow acess to the services based on their consent. 
  • Accreditation applicants. Through the form established for this purpose, the applicants can provide their name and surnames, e-mail or telephone. ENAC will use this data to manage the requested services. The legal basis for the processing of such data is bases on the execution of the contract signed with ENAC.
  • Assessors. ENAC can collaborate with experienced professionals in laboratories, certification or inspection entities, or in related activities such as auditing or consulting. For this purpose, ENAC will need some data of the interested parties: name and surnames, e-mail or telephone to process the corresponding request for collaboration. The legal basis for the processing of such data is based on the execution os the contract signed by ENAC and the assessors. To collaborate with ENAC, the assessors shall need to provide personal information related to their suitability in terms of Occupational health and safety. The data will be processed by ENAC in order to comply with current legislation and may be communicated to the clients to whom they provide the audit services. The basis for the processing this data in based on the fulfillment of a legal obligation.
  • Queries, complaints or success stories. To process and respond to the needs and expectations of all Users regarding accreditation and accredited conformity assessment services. Your data will only be used to handle the complaint or information provided when completing the questionnaire in our “Let us know” sections or by e-mailing enac@enac.es. Likewise, users who have used the accredited services and reaped the benefits or solved a specific problem can tell us about it by e-mailing comunicacion@enac.es.
  • Subscriptions to Accreditation News. To sign up for free to ENAC’s online information, including news and publications about accreditation activities, developments and events. You may cancel your subscription at any time using the subscription form, simply by entering your e-mail address and selecting the “unsubscribe” option or by using any of the channels for this purpose. The legal basis of the processing of such data is based on user consent.
  • Training courses. This includes administrative and accounting management and, if you have given us permission, the opportunity to tell you about similar courses or competitions of possible interest to you. All the information about the purchase process is available in the general contracting conditions section. The legal basis of the treatment of such data is based on the execution of a contract.
  • Join us. To process your application for a job vacancy published by ENAC, for which the data subject has sent ENAC his or her CV or to process applications to collaborate with ENAC as an Assessor or Technical Expert in any of the schemes and fields in which ENAC delivers services, for which the data subject has sent ENAC his or her CV. The legal basis of the processing of such data is based on consent.  

3. Data accuracy and veracity

As User, you are solely responsible for the veracity and correctness of the data that you submit and release ENAC from any liability in this regard. The User warrants and shall in all events be held liable for the accuracy, validity and authenticity of the personal data supplied and undertakes to keep it updated.

4. How long will we keep your data?

If you are an ENAC client, your data will be retained for the duration of the contractual relationship. At the end of the contract, ENAC will keep your personal data locked for the legal prescription periods. At the end of the legal prescription periods, we will destroy your data.

In the event that the data has been provided to meet obligations in terms of occupational health and safety, ENAC will keep your data for the legally established period for it, after which, the data will be destroyed.

If the data was supplied for the purpose of a complaint or feedback, it will be stored for the time needed for its proper management. At the end of this period, ENAC will keep your personal data locked for the legal or contractual prescription periods. We will destroy your data when this period expires.

If the data was collected for subscription purposes, it will be retained until you end your subscription or the service is terminated. If it is to evaluate an application that proves unsuccessful, this will be after processing.

In the event that you have provided your data to ENAC within the framework of a selection process, it will keep your data for the duration of said process.

5. Data privacy and security

ENAC agrees to use and process the personal data of Users, respecting its confidentiality and the purpose for which it was provided, complying with its obligation to store such data and adopt all necessary measures to prevent its alteration, loss, unauthorised processing or access, under current data protection legislation.

ENAC cannot guarantee the total impregnability of the Internet and consequent breach of the data through fraudulent access thereto by third parties.

Confidentiality of processing. ENAC will ensure that any person authorised by our company to process the data of clients and Users (including their staff, collaborators and providers) is subject to the relevant duty of confidentiality (whether contractual or legal).

Security incident response. When a security incident is detected, ENAC must report it without undue delay to the client or User and provide timely information as is known in relation thereto or when reasonably requested by the Client or User.

6. Disclosure of data for legal reasons

ENAC may find itself under a legal obligation to disclose your personal data under a subpoena, mandate or court order in any of the countries in which we operate, and may disclose your personal data for the purpose of enforcing the Terms of Use of our Website or in emergency situations to protect the personal safety of the general public or of the Website.

7. What rights do you have to the data you provide?

You can exercise your rights under the GDPR free of charge:

  • Right to request access to personal data concerning the data subject,
  • Right to request rectification or erasure,
  • Right to request the restriction of processing. You can request this:
    • When the accuracy of the personal data is contested,
    • During the period in which the controller is allowed to verify the accuracy of the data,
    • When the processing is unlawful and the data subject opposes the erasure of the personal data,
    • When the controller no longer needs the personal data for processing purposes, but the data subject needs it for making a complaint, etc.
  • Right to object to the processing,
  • Right to data portability.

You likewise have the right to withdraw your consent, which means that you will be removed from the services, given that the latter legitimise us to process your data.

You can exercise your rights of access, rectification, erasure, objection, portability and restriction of processing of your data by writing to ENTIDAD NACIONAL DE ACREDITACIÓN, C/ Serrano 240, 4ª A-B 28016 Madrid or e-mailing rgpd@enac.es, attaching a copy of your ID card as proof of your identity, indicating the reference “Data Protection”. Your request must include: Name, surname(s) and photocopy of your ID card, the details of your request and your address for notification purposes.

If you are not satisfied with the response of ENTIDAD NACIONAL DE ACREDITACIÓN, you have the right to lodge a complaint with the supervisory authority, the Spanish Data Protection Agency (www.aepd.es) to request the protection of your rights.